Security audit

Save/Load Context

Security checks for vulnerabilities and agentic risk

Overview

This plugin appears to do what it claims: locally save, list, load, and delete OpenClaw conversation contexts, with sensitive but disclosed persistence behavior.

Install only if you are comfortable with conversation history being stored locally in plaintext and later restored into an agent session. Avoid saving credentials, private keys, personal data, or untrusted prompt text unless you intentionally want that content persisted and reloaded. Review old saves periodically and delete ones you no longer need.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The skill advertises simple save/load behavior, but the documented behavior also includes destructive deletion, transcript replacement, session remapping, and injection of a system event that instructs the agent to read a file and act as though it remembers prior context. Those extra capabilities materially change trust and threat assumptions because they can alter agent state and introduce hidden prompt/context injection paths that are not clearly surfaced in the top-level description.

Description-Behavior Mismatch

Medium

Confidence: 98% confidence
Finding: On load, the plugin injects a system event that instructs the agent to read an arbitrary saved file path and 'continue the conversation naturally, as if you remember everything.' This bridges stored untrusted conversation content back into privileged runtime context, enabling prompt injection persistence, replay of sensitive prior data, and bypass of normal user-turn boundaries.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The documentation exposes a `/load --delete` command that permanently removes saved conversation files, but it does not prominently warn users about the irreversible nature of that action. In a context-preservation plugin, omission of that warning increases the chance of accidental data loss and unsafe operator assumptions.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill states that conversations are saved to disk but does not warn that those files may contain sensitive prompts, credentials, personal data, or other confidential context. Because the plugin is specifically designed to persist chat history across sessions, failure to disclose retention and local-storage risk can lead users to store sensitive data without informed consent or protective controls.

Ssd 3

High

Confidence: 99% confidence
Finding: The injected system event explicitly directs the agent to read the saved conversation file and treat its contents as remembered context. Because save files contain prior user/assistant text and are loaded from disk, this creates a durable prompt-injection channel and can reintroduce sensitive or adversarial instructions into a privileged system-message path on future turns.

Static analysis

No suspicious patterns detected.